CVE-2026-59243

Name of the Vulnerable Software and Affected Versions apache-airflow-providers-fab versions prior to 3.7.3

Description The FAB auth manager's Azure AD OAuth login process failed to verify the signature of the ID token by default, as the verify signature variable was set to False. This allows an attacker to bypass authentication and log in as any user, including those with Admin privileges, by providing a forged or unsigned ID token (using alg:none) to the OAuth callback.

Recommendations Upgrade to version 3.7.3.